2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2024-01-02 21:36:20 +03:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-15 19:00:52 +03:00
|
|
|
|
2017-02-02 22:49:20 +03:00
|
|
|
package vault
|
|
|
|
|
|
|
|
import (
|
2018-01-19 09:44:44 +03:00
|
|
|
"context"
|
2017-02-02 22:49:20 +03:00
|
|
|
"fmt"
|
2017-02-16 04:35:35 +03:00
|
|
|
"strings"
|
2017-02-02 22:49:20 +03:00
|
|
|
"sync"
|
|
|
|
|
2019-04-13 00:54:35 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
2017-02-02 22:49:20 +03:00
|
|
|
)
|
|
|
|
|
2017-02-16 04:35:35 +03:00
|
|
|
// N.B.: While we could use textproto to get the canonical mime header, HTTP/2
|
|
|
|
// requires all headers to be converted to lower case, so we just do that.
|
|
|
|
|
2017-02-02 22:49:20 +03:00
|
|
|
const (
|
|
|
|
// Key used in the BarrierView to store and retrieve the header config
|
|
|
|
auditedHeadersEntry = "audited-headers"
|
|
|
|
// Path used to create a sub view off of BarrierView
|
|
|
|
auditedHeadersSubPath = "audited-headers-config/"
|
|
|
|
)
|
|
|
|
|
|
|
|
type auditedHeaderSettings struct {
|
|
|
|
HMAC bool `json:"hmac"`
|
|
|
|
}
|
|
|
|
|
|
|
|
// AuditedHeadersConfig is used by the Audit Broker to write only approved
|
|
|
|
// headers to the audit logs. It uses a BarrierView to persist the settings.
|
|
|
|
type AuditedHeadersConfig struct {
|
|
|
|
Headers map[string]*auditedHeaderSettings
|
|
|
|
|
|
|
|
view *BarrierView
|
|
|
|
sync.RWMutex
|
|
|
|
}
|
|
|
|
|
|
|
|
// add adds or overwrites a header in the config and updates the barrier view
|
2018-01-19 09:44:44 +03:00
|
|
|
func (a *AuditedHeadersConfig) add(ctx context.Context, header string, hmac bool) error {
|
2017-02-02 22:49:20 +03:00
|
|
|
if header == "" {
|
|
|
|
return fmt.Errorf("header value cannot be empty")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Grab a write lock
|
|
|
|
a.Lock()
|
|
|
|
defer a.Unlock()
|
|
|
|
|
2017-02-16 08:44:20 +03:00
|
|
|
if a.Headers == nil {
|
|
|
|
a.Headers = make(map[string]*auditedHeaderSettings, 1)
|
|
|
|
}
|
|
|
|
|
2017-02-16 04:35:35 +03:00
|
|
|
a.Headers[strings.ToLower(header)] = &auditedHeaderSettings{hmac}
|
2017-02-02 22:49:20 +03:00
|
|
|
entry, err := logical.StorageEntryJSON(auditedHeadersEntry, a.Headers)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to persist audited headers config: %w", err)
|
2017-02-02 22:49:20 +03:00
|
|
|
}
|
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
if err := a.view.Put(ctx, entry); err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to persist audited headers config: %w", err)
|
2017-02-02 22:49:20 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// remove deletes a header out of the header config and updates the barrier view
|
2018-01-19 09:44:44 +03:00
|
|
|
func (a *AuditedHeadersConfig) remove(ctx context.Context, header string) error {
|
2017-02-02 22:49:20 +03:00
|
|
|
if header == "" {
|
|
|
|
return fmt.Errorf("header value cannot be empty")
|
|
|
|
}
|
|
|
|
|
|
|
|
// Grab a write lock
|
|
|
|
a.Lock()
|
|
|
|
defer a.Unlock()
|
|
|
|
|
2017-02-16 08:44:20 +03:00
|
|
|
// Nothing to delete
|
|
|
|
if len(a.Headers) == 0 {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-02-16 04:35:35 +03:00
|
|
|
delete(a.Headers, strings.ToLower(header))
|
2017-02-02 22:49:20 +03:00
|
|
|
entry, err := logical.StorageEntryJSON(auditedHeadersEntry, a.Headers)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to persist audited headers config: %w", err)
|
2017-02-02 22:49:20 +03:00
|
|
|
}
|
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
if err := a.view.Put(ctx, entry); err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to persist audited headers config: %w", err)
|
2017-02-02 22:49:20 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// ApplyConfig returns a map of approved headers and their values, either
|
|
|
|
// hmac'ed or plaintext
|
2018-03-08 22:21:11 +03:00
|
|
|
func (a *AuditedHeadersConfig) ApplyConfig(ctx context.Context, headers map[string][]string, hashFunc func(context.Context, string) (string, error)) (result map[string][]string, retErr error) {
|
2017-02-02 22:49:20 +03:00
|
|
|
// Grab a read lock
|
|
|
|
a.RLock()
|
|
|
|
defer a.RUnlock()
|
|
|
|
|
2017-02-16 04:35:35 +03:00
|
|
|
// Make a copy of the incoming headers with everything lower so we can
|
|
|
|
// case-insensitively compare
|
|
|
|
lowerHeaders := make(map[string][]string, len(headers))
|
|
|
|
for k, v := range headers {
|
|
|
|
lowerHeaders[strings.ToLower(k)] = v
|
|
|
|
}
|
|
|
|
|
2017-02-02 22:49:20 +03:00
|
|
|
result = make(map[string][]string, len(a.Headers))
|
|
|
|
for key, settings := range a.Headers {
|
2017-02-16 04:35:35 +03:00
|
|
|
if val, ok := lowerHeaders[key]; ok {
|
2017-02-02 22:49:20 +03:00
|
|
|
// copy the header values so we don't overwrite them
|
|
|
|
hVals := make([]string, len(val))
|
|
|
|
copy(hVals, val)
|
|
|
|
|
|
|
|
// Optionally hmac the values
|
|
|
|
if settings.HMAC {
|
|
|
|
for i, el := range hVals {
|
2018-03-08 22:21:11 +03:00
|
|
|
hVal, err := hashFunc(ctx, el)
|
2017-05-24 03:36:20 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
hVals[i] = hVal
|
2017-02-02 22:49:20 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
result[key] = hVals
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-05-24 03:36:20 +03:00
|
|
|
return result, nil
|
2017-02-02 22:49:20 +03:00
|
|
|
}
|
|
|
|
|
2018-03-20 21:54:10 +03:00
|
|
|
// Initialize the headers config by loading from the barrier view
|
2018-01-19 09:44:44 +03:00
|
|
|
func (c *Core) setupAuditedHeadersConfig(ctx context.Context) error {
|
2017-02-02 22:49:20 +03:00
|
|
|
// Create a sub-view
|
|
|
|
view := c.systemBarrierView.SubView(auditedHeadersSubPath)
|
|
|
|
|
|
|
|
// Create the config
|
2018-01-19 09:44:44 +03:00
|
|
|
out, err := view.Get(ctx, auditedHeadersEntry)
|
2017-02-02 22:49:20 +03:00
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to read config: %w", err)
|
2017-02-02 22:49:20 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
headers := make(map[string]*auditedHeaderSettings)
|
|
|
|
if out != nil {
|
|
|
|
err = out.DecodeJSON(&headers)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-02-16 04:35:35 +03:00
|
|
|
// Ensure that we are able to case-sensitively access the headers;
|
|
|
|
// necessary for the upgrade case
|
|
|
|
lowerHeaders := make(map[string]*auditedHeaderSettings, len(headers))
|
|
|
|
for k, v := range headers {
|
|
|
|
lowerHeaders[strings.ToLower(k)] = v
|
|
|
|
}
|
|
|
|
|
2017-02-02 22:49:20 +03:00
|
|
|
c.auditedHeaders = &AuditedHeadersConfig{
|
2017-02-16 04:35:35 +03:00
|
|
|
Headers: lowerHeaders,
|
2017-02-02 22:49:20 +03:00
|
|
|
view: view,
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|